verify_resowner_scope does the verification instead of authenticate_username_password.